From 0f6e7d75e3d48600adb60722e59cab0a446496d0 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 29 May 2026 01:41:27 +0100 Subject: [PATCH] =?UTF-8?q?status(2w):=20gate=20scope=20note=20=E2=80=94?= =?UTF-8?q?=20WC1.1=20proven=20for=20keycloak=20(stateful);=20traefik=20WC?= =?UTF-8?q?1.1=20=3D=20W0.10=20follow-up?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/STATUS-2w.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/machine-docs/STATUS-2w.md b/machine-docs/STATUS-2w.md index 6098a8f..304c240 100644 --- a/machine-docs/STATUS-2w.md +++ b/machine-docs/STATUS-2w.md @@ -150,6 +150,13 @@ warm-keycloak.nix` (systemd reconcile unit). Warm state on cc-ci under `/var/lib 10.7.2+26.6.3.md` containing "manual migration" → `held-manual-migration`, alert carries the notes. (Builder ran both live: held + untouched.) +**SCOPE (honest).** WC1 and WC1.2 are complete. **WC1.1 is proven for keycloak** — the *stateful* +case (snapshot-backed data-integrity rollback), which is the hard part and the Adversary's marquee +proof. **traefik's WC1.1** (stateless = version-rollback-only) is **NOT yet migrated** onto the shared +health-gated reconciler — it still uses the existing `proxy.nix` chaos-deploy reconciler. That +migration is **W0.10** (tracked in BACKLOG-2w), to land before the Phase-2w DONE. If the Adversary +wants WC1.1 fully closed (both reconcilers) before PASS, treat this gate as WC1 + WC1.2 + WC1.1(keycloak). + **Alert delivery note (not blocking):** the reconciler WRITES alert sentinels to `/var/lib/ci-warm/alerts/*.json` (proven above). The operator-facing relay (Builder loop scans → PushNotification → archive to `alerts/seen/`) is loop behavior, run each wake when an alert exists;